chore: massive refactor (anti ai-slop)

Author: lucas-guerin-44

.env.example

@@ -25,13 +25,10 @@ LOG_LEVEL=INFO
 # Database URL (auto-constructed in Docker; set for local dev)
 # DATABASE_URL=postgresql://datalake:datalake@localhost:6543/datalake
 
-# MT5 bridge (Wine-hosted RPC server running alongside MT5 terminal).
-# The bridge (scripts/mt5_bridge.py) is required for /ingest/refresh.
-# Inside Docker the host is reachable via host.docker.internal on Linux too
-# if you enable it in docker-compose (extra_hosts: ["host.docker.internal:host-gateway"]).
-MT5_BRIDGE_URL=http://host.docker.internal:18812
-MT5_BRIDGE_TIMEOUT=120
-# Shared secret sent in X-Bridge-Key; must match the value in
-# /etc/datalake/mt5-bridge-key on the VPS host. Empty = auth disabled (dev only).
-#   python3 -c 'import secrets; print(secrets.token_urlsafe(24))'
-MT5_BRIDGE_KEY=
+# Broker timezone for CSV files with broker-local timestamps (e.g. MetaTrader exports).
+# Used during tick-file ingest to convert <DATE>/<TIME> columns to UTC.
+BROKER_TZ=Europe/Athens
+
+# DuckDB memory limit for the timezone migration command (POST /catalog/migrate-timezone).
+# Defaults to DUCKDB_MEMORY_LIMIT if unset. Increase for large databases.
+# MIGRATION_MEMORY_LIMIT=4GB

deploy/datalake-backup.service

@@ -13,6 +13,6 @@ EnvironmentFile=/etc/datalake/api-key
 ExecStart=/usr/bin/curl --fail --silent --show-error --max-time 300 \
     -X POST \
     -H "X-API-Key: ${API_KEY}" \
-    "https://datalake.example.com/api/backup/run?keep=8"
+    "http://localhost/api/backup/run?keep=8"
 StandardOutput=journal
 StandardError=journal

deploy/datalake-refresh.service

@@ -1,5 +1,6 @@
 services:
   postgres:
+    # Pin to digest in production for reproducibility: postgres:16-alpine@sha256:<digest>
     image: postgres:16-alpine
     container_name: datalake-postgres
     environment: